Resubmissions
17-12-2023 23:15
231217-28y5vagccl 1027-10-2023 11:50
231027-nzmhssfg49 1014-10-2023 04:05
231014-enwgwshf97 10Analysis
-
max time kernel
104s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2023 11:50
Behavioral task
behavioral1
Sample
6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac.dll
Resource
win10v2004-20231023-en
General
-
Target
6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac.dll
-
Size
12.1MB
-
MD5
d771632ff34c40d105363d7035f3cf4b
-
SHA1
af2ff96d8f81b3e3df2756ac27c9d23f35432435
-
SHA256
6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac
-
SHA512
fe954ed4e752f50b5aae5de36bb760610044acc3d19056b24b9a4ec6937d5c5c60f3ebd4d61b86c22af01599f2dc13e159714260c7d32877753b0e600e82a300
-
SSDEEP
196608:keOD8HOauP9k8YOOBQMfhXx/LVjuMP/2sP:Vw8CP8OOBZLLVaK/2s
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
Processes:
rundll32.exeflow pid Process 8 1540 rundll32.exe 27 1540 rundll32.exe 31 1540 rundll32.exe 34 1540 rundll32.exe 39 1540 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 4988 1540 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid Process 4148 powershell.exe 4148 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 4148 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid Process procid_target PID 4212 wrote to memory of 1540 4212 rundll32.exe 85 PID 4212 wrote to memory of 1540 4212 rundll32.exe 85 PID 4212 wrote to memory of 1540 4212 rundll32.exe 85 PID 1540 wrote to memory of 4148 1540 rundll32.exe 87 PID 1540 wrote to memory of 4148 1540 rundll32.exe 87 PID 1540 wrote to memory of 4148 1540 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension "exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 10523⤵
- Program crash
PID:4988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 15401⤵PID:4904
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82